How a HIPAA case starts, and how it ends.

HHS Office for Civil Rights

Enforces the Privacy, Security and Breach Notification Rules through investigations, compliance reviews and civil money penalties.

Department of Justice

Prosecutes criminal cases where PHI is knowingly obtained or disclosed in breach of the law.

State attorneys general

May bring civil actions in federal court on behalf of state residents, a power added by the HITECH Act.

Centers for Medicare & Medicaid Services

Enforces the transactions, code sets and identifier rules, which sit apart from privacy and security.

Since the 2013 changes to the rules, business associates are directly liable for their own Security Rule failures and for certain Privacy Rule duties. A vendor cannot assume the client absorbs the risk.

1. 1ComplaintsAnyone may file one in writing, generally within 180 days of learning of the problem, a limit OCR can waive for good cause. Patients and staff are the usual sources.
2. 2Breach reportsYour own notification to HHS can open an inquiry. Breaches affecting 500 or more people are reported promptly and are commonly followed up.
3. 3Compliance reviews and auditsOCR may review an organisation on its own initiative, and the HITECH Act requires a programme of periodic audits.

Where a preliminary look suggests a possible violation due to willful neglect, the rules require HHS to investigate. In other cases investigation is at its discretion.

1. Intake. OCR checks the complaint or report is timely and falls under HIPAA, and that the organisation is a covered entity or business associate.
2. Data request. OCR writes asking for policies, the risk analysis, training records, BAAs, logs and an account of the events.
3. Assessment. Investigators compare what you sent with what the rules require and with what happened.
4. Informal resolution. Many cases close here: no violation found, technical assistance, or voluntary corrective steps you show were taken.
5. Resolution agreement. Where problems are serious, OCR may settle with a payment and a corrective action plan, without a finding of liability.
6. Proposed penalty. If the matter is not resolved, HHS may issue a notice of proposed civil money penalty.
7. Hearing and appeal. The organisation can request a hearing before an administrative law judge, with a further appeal inside HHS.

1. Tier 1
   Did not knowYou did not know of the violation and, using reasonable diligence, would not have known.
2. Tier 2
   Reasonable causeThe violation had reasonable cause and was not due to willful neglect.
3. Tier 3
   Willful neglect, correctedDue to willful neglect, but corrected within 30 days of when you knew or should have known.
4. Tier 4
   Willful neglect, not correctedDue to willful neglect and not corrected in that window. The heaviest tier.

Each tier has a minimum and maximum per violation and a calendar-year cap for identical violations. HHS adjusts the amounts for inflation every year, so we do not quote them here: check the current schedule HHS publishes in the Federal Register.

HHS has in the past applied lower annual caps for the less culpable tiers through a notice of enforcement discretion. Confirm what applies now before relying on any figure.

1. 1Nature and extentHow many people, how long it lasted, what kind of PHI.
2. 2HarmPhysical, financial or reputational harm, and any effect on access to care.
3. 3HistoryEarlier compliance problems, and how you responded to them.
4. 4Financial conditionWhether a penalty would threaten your ability to keep providing care.

The criminal provision covers a person who knowingly obtains or discloses individually identifiable health information in breach of HIPAA. Penalties rise where the act involved false pretences, or an intent to sell or use the information for commercial advantage, personal gain or malicious harm. The Department of Justice brings these cases, and they can reach individual employees, not just organisations.

State attorneys general can sue in federal court to stop violations or recover damages for residents, after notice to HHS. Separately, many states have their own privacy and breach notification laws that can apply to the same incident.

• A fresh risk analysis. Enterprise-wide, submitted to HHS for review.
• A risk management plan. With dates, approved by HHS, then carried out.
• Revised policies. Submitted for approval and rolled out.
• Training. On the revised policies, with records.
• Monitoring and reports. Regular reports to HHS for a set period, commonly measured in years.

• No enterprise-wide risk analysis. The most frequent theme: an analysis that was missing, partial or stale.
• No risk management. Risks known and recorded, but not acted on.
• Missing BAAs. PHI shared with a vendor before any agreement was signed.
• Unencrypted portable devices. A lost laptop or drive that encryption would have kept out of the breach count.
• Slow patient access. Patients waiting too long, or paying too much, for copies of their own records.
• No activity review. Logs collected, but nobody looking, so intrusions ran for months.

Sources: 45 CFR Part 160, Subparts C to E (compliance, investigations, civil money penalties, hearings), including 160.306, 160.404 and 160.408; 42 U.S.C. 1320d-5 and 1320d-6; HITECH Act sections 13410 and 13411; Public Law 116-321 (recognised security practices); HHS OCR enforcement and resolution agreement pages.